#19998: Stop allowing 3DES in TLS ciphersuites --------------------------+------------------------------------ Reporter: nickm | Owner: Type: defect | Status: new Priority: Medium | Milestone: Tor: 0.2.9.x-final Component: Core Tor/Tor | Version: Severity: Normal | Resolution: Keywords: tor-spec | Actual Points: Parent ID: | Points: .2 Reviewer: | Sponsor: --------------------------+------------------------------------ Changes (by yawning):
* keywords: => tor-spec Comment: I agree with the suggested fixes. This will require a tor-spec update as well since 3DES is listed as mandatory in a few locations (primarily in relation to outdated link handshakes), and although it is unlikely that someone will implement a tor that only supports 3DES, the spec should reflect the code. While we are revisiting the allowed cipher suites, should we proscribe the RC4 ones? It's even less likely that any of those will be negotiated, and they're just as flawed as 3DES.... (Probably a separate ticket?) -- Ticket URL: <https://trac.torproject.org/projects/tor/ticket/19998#comment:1> Tor Bug Tracker & Wiki <https://trac.torproject.org/> The Tor Project: anonymity online _______________________________________________ tor-bugs mailing list tor-bugs@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs